Exam CRISC topic 1 question 673 discussion

D. Review risk tolerance levels. When risk is found to be above the acceptable risk appetite, the best course of action is to review risk tolerance levels. This involves reassessing the organization's tolerance for the specific risk and determining whether the current risk appetite and thresholds are still appropriate. Before executing the risk response plan or making significant changes to controls, it's essential to ensure that the risk tolerance levels are correctly defined and aligned with the organization's objectives and strategies. Reviewing risk tolerance allows for a more informed decision-making process, and it may lead to adjustments in the risk management approach, including changes to controls, risk acceptance, or other risk response actions.

Going with A, as the risk response plan is expected to be the implementation of how to handle the risk, which could be several options (mitigate, accept, etc.)

Correction, reason: The risk response plan outlines the actions that should be taken when a risk exceeds the acceptable risk level. The response could be to mitigate the risk, transfer the risk, avoid the risk, or accept the risk. The plan should have been developed during the risk management planning phase and should be reviewed periodically to ensure that it remains relevant and effective. Therefore, executing the risk response plan would be the most appropriate action to take in this situation.

should be A

Just mentioning the CRISC manual does not justify a bad answer. The tolerance level is a deviation from the risk appetite and when this happens what it is about is analyzing the cause, which is usually a lack of effectiveness of the controls.

B is correct guys. C'mon, C & D are obviously incorrect.

CRISC Manual 7th edition p.69. Support answer D. Tolerance levels need to be reviewed even if the risk is above the appetite.

agree A

Should be A

Should be A, if risks above acceptable lvl, u need compensation controls. Compensation or additional controls come from risk response plan.

Shouldn’t it be D - review the threshold?